Daylight quantum key distribution over 1.6 km 
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Quantum key distribution (QKD) has been demonstrated over a point-to-point ~ 1.6-km atmo- 
spheric optical path in full daylight. This record transmission distance brings QKD a step closer to 
surface-to-satellite and other long-distance applications. 

PACS Numbers: 03.65. Bz, 42.79.Sz 
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Quantum cryptography was introduced in the mid- 
1980s § as a new method for generating the shared, se- 
cret random number sequences, known as cryptographic 
keys, that are used in crypto- systems to provide commu- 
nications security (for a review see The appeal of 
quantum cryptography (or more accurately, quantum key 
distribution, QKD) is that its security is based on laws of 
nature and information-theoretically secure techniques, 
in contrast to existing methods of key distribution that 
derive their security from the perceived intractability of 
certain problems in number theory, or from the physical 
security of the distribution process. 

Several groups have demonstrated QKD over multi- 
kilometer distances of optical fiber ||, but there are 
many key distribution problems for which QKD over line- 
of-sight atmospheric paths would be advantageous (for 
example, it is impractical to send a courier to a satel- 
lite). Free-space QKD was first demonstrated in 1990 
over a point-to-point 32-cm table top optical path, 
and recent work has produced atmospheric transmission 
distances of 75 m || (daytime) and 1 km (nighttime) 
over outdoor folded paths (to a mirror and back). The 
close collocation of the QKD transmitter and receiver in 
folded-path experiments is not representative of practi- 
cal applications and can result in some compensation of 
turbulence effects. We have recently performed the first 
point-to-point atmospheric QKD in full daylight, achiev- 
ing a 0.5-km transmission range H|, and here we report 
a record 1.6-km point-to-point transmission in daylight, 
with a novel QKD system that has no active polarization 
switching elements. 

The success of QKD over atmospheric optical paths 
depends on the transmission and detection of single- 
photons against a high background through a turbulent 
medium. Although this problem is difficult, a combi- 
nation of temporal, spectral [9|JlO|] and spatial filtering 
Jil"| can render the transmission and detection problems 
tractable ||]. The essentially non-birefringent nature of 
the atmosphere at optical wavelengths allows the faith- 
ful transmission of the single-photon polarization states 
used in the free-space QKD protocol. 

A QKD procedure starts with the sender, "Alice," gen- 
erating a secret random binary number sequence. For 
each bit in the sequence, Alice prepares and transmits 



a single photon to the recipient, "Bob," who measures 
each arriving photon and attempts to identify the bit 
value Alice has transmitted. Alice's photon state prepa- 
rations and Bob's measurements are chosen from sets of 
non-orthogonal possibilities. For example, using the B92 
protocol jjl^j Alice agrees with Bob (through public dis- 
cussion) that she will transmit a 45° polarized photon 
state |45), for each "0" in her sequence, and a vertical 
polarized photon state \v), for each "1" in her sequence. 
Bob agrees with Alice to randomly test the polarization 
of each arriving photon with —45° polarization, |— 45), to 
reveal "Is," or horizontal polarization, \h), to reveal "Os." 
In this scheme Bob will never detect a photon for which 
he and Alice have used a preparation/measurement pair 
that corresponds to different bit values, such as \h) and 
\v), which happens for 50% of the bits in Alice's sequence. 
However, for the other 50% of Alice's bits the preparation 
and measurement protocol uses non-orthogonal states, 
such as for 1 45) and \h), resulting in a 50% detection 
probability for Bob. Thus, by detecting single-photons 
Bob identifies a random 25% portion of the bits in Al- 
ice's random bit sequence, assuming a single-photon Fock 
state with no bit loss in transmission or detection. This 
25% efficiency factor, r/Q, is the price that Alice and Bob 
must pay for secrecy. 

Bob and Alice reconcile their common bits by reveal- 
ing the locations, but not the bit values, in the sequence 
where Bob detected photons; Alice retains only those de- 
tected bits from her initial sequence. In practical sys- 
tems the resulting sifted key sequences 1 13 , will contain 
errors; a pure key is distilled from them using classical er- 
ror detection techniques. The single-photon nature of the 
transmissions ensures that an eavesdropper, "Eve," can 
neither "tap" the key transmissions with a beam split- 
ter (BS), owing to the indivisibility of a photon fl4| , nor 
faithfully copy them, owing to the quantum "no-cloning" 
theorem |jl5|| . Furthermore, the non-orthogonal nature of 
the quantum states ensures that if Eve makes her own 
measurements she will be detected through the elevated 
error rate she causes by the irreversible "collapse of the 
wavefunction" |ll|. From the observed error rate and a 
model for Eve's eavesdropping strategy, Alice and Bob 
can calculate a rigorous upper bound on the infomation 
Eve might have obtained. Then, using the technique 
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of generalized privacy amplification by public discussion 
jl7j Alice and Bob can distill a shorter, final key on which 
Eve has less than one bit of information. 

The QKD transmitter ("Alice") in our experiment 
(Fig. [TJfoperates at a clock rate Rq = 1-MHz. On each 
"tick" of the clock a ~ 1-ns vertically-polarized optical 
"bright pulse" is produced from a "timing-pulse" diode 
laser whose wavelength is temperature controlled to ~ 
768 nm. After a ~ 100-ns delay one of two temperature- 
controlled dim pulse "data" diode lasers emits a ~ 1- 
ns optical pulse that is attenuated to the single-photon 
level jllj and constrained by an interference filter (IF) to 
773 ±0.5 nm to remove wavelength information. Polariz- 
ers set one data laser's output to be 45° polarized and the 
other to be vertically polarized as required for the B92 
protocol. The choice of which data laser fires is deter- 
mined by a random bit value that is obtained by discrim- 
inating electrical noise. The random bit value is indexed 
by the clock tick and recorded in Alice's computer con- 
trol system's memory. All three optical pulse paths are 
combined with beamsplitters (BSs) into a single-mode 
(SM) optical fiber to remove spatial mode information, 
and transmitted toward Bob's receiver through a 27x 
beam expander (to extend the system Rayleigh range). 
A single-photon detector (SPD) |19| located behind a 
matched IF in one of the BS output ports is used to mon- 
itor the average photon number h of the dim-pulses as 
follows: (1) a calibration photon- number measurement is 
made from the rate at which a calibrated single-photon 
counting module (SPCM) p3 fires at the transmitter's 
SM transmission-fiber output with a given input, (2) 
next the transmitter's SPD count rate is calibrated to 
the SPCM firing rate with the same input to determine 
the SPD efficiency, which is then (3) used with the ex- 
perimental SPD count rates to measure the transmitted 
n in key generation mode. 

At the QKD receiver ( "Bob" ) light pulses are collected 
by a 8.9-cm diameter Cassegrain telescope and directed 
into a polarization analysis and detection system (Fig. 
||). A bright pulse triggers a "warm" avalanche photodi- 
ode (APD), which sets up a narrow ~ 5-ns coincidence 
gate in which to test a subsequent dim pulse's polariza- 
tion [pl| . A BS randomly directs dim pulses along one of 
two paths. Polarization elements along the upper path 
are set to transmit —45° polarization in accordance with 
Bob's B92 "1" value, while along the lower path a mea- 
surement for \h) to reveal "0"s is made using a polarizing 
beamsplitter (PBS). (The PBS transmits \h) but reflects 
\v).) Each analysis path contains a matched IF and cou- 
ples to a SPD via multi-mode (MM) fiber that provides 
limited spatial filtering, giving the receiver a restricted 
200 /i-radian field of view. For events on which one of 
the two SPDs triggers during the coincidence gate, Bob 
can assign a bit value to Alice's transmitted bit; upper- 
path SPD firings identify "l"s, and lower-path SPD fir- 
ings identify "0"s. He records these detected bits in the 



memory of his computer control system, indexed by the 
"bright pulse" clock tick. Bit generation is completed 
when Bob communicates the locations, but not values, 
of his photon detections in Alice's random bit-sequence 
over a public channel: wireless ethernet in our experi- 
ment. 

The QKD system was operated over a 1.6-km outdoor 
range with excellent atmospheric conditions on Friday 13 
August 1999 beginning at 09:30 LST under cloudless New 
Mexico skies. By 11:30 LST turbulence induced beam- 
spreading hindered our ability to efficiently acquire data 
at low bit-error rates (BER), e (where BER, e, is defined 
as the ratio of the number of bits received in error to the 
total number of bits received). The system efficiency, 
Vsystem, which accounts for losses between the transmit- 
ter and MM fibers at the receiver, and the receiver's SPDs 
efficiencies had an average value of (r} S y S tem) ~ 0.13 with 
a standard deviation of a — 0.04. Fluctuations in r) sys t e m 
were caused by turbulence induced beam-spreading and 
beam-wander; the typical beam-wander was observed 
to be on the order of 3 to 5 //-radians. (Our present 
system has no beam-steering or adaptive-optics technol- 
ogy to compensate for turbulence-induced effects.) The 
VQ = 0-25 quantum efficiency of the B92 protocol lowers 
the overall efficiency to rj — T]Qr] S y S t em ~ 0.0325 and leads 
to a detection probability for Bob of Pb = 1 — exp(—rj n). 
This gave a bit-rate of R ~ 5.4, 12.2, and 17-kHz at 
n ~ 0.2, 0.35, and 0.5-photons per dim-pulse, respec- 
tively, when the lasers were pulsed at Rq = 1 MHz. Bits 
were transmitted in 25, 50, and 100 k-bit blocks. A total 
of 1.55 M-bits were sent in 40 data exchanges between Al- 
ice and Bob and 17, 420 bits of sifted key were received. 
Table | includes a typical 250-bit sample from one of sev- 
eral 1.6-km daylight transmissions on 13 August 1999. 
The sifted key shown contains eight bit-errors (in bold) 
corresponding to e = 3.2% for these 250 bits and has a 
60:40 bias toward ones (the average bias for all exper- 
iments on 13 August 1999 was 50.3:49.7 toward ones). 
The average BER on all key material acquired during 
the daylight transmissions was (e) = 5.3%. These BERs 
would be regarded as unacceptably high in any conven- 
tional telecommunications application but are tolerated 
in QKD because of the secrecy of the bits. 

The dominant BER component is from the ambient 
solar background, with a measured noise probability for 
both detectors of about 6.7 x 10~ 4 per coincidence gate, 
contributing about 5.9% to the (e) = 7.8% at n = 0.2 
data, about 2.4% to the (e) = 4.1% at fi = 0.35, and 
about 1.9% to the (e) = 4.1% at fi = 0.5. (The ambient- 
background is somewhat less than that expected from the 
daylight radiance [Q , which we attribute to Bob viewing 
the dark interior of the tent housing Alice's transmit- 
ter.) Imperfections and misalignments of the polarizing 
elements were the next largest contribution (about 1.9%) 
to the total BERs on 13 August 1999. Experience from 
previous experiments ||,|7],[ll| suggests that this compo- 



nent of BER can be reduced to about 0.5%. Detector 
dark noise (~ 1,400 dark-counts per second) makes an 
even smaller contribution of < 0.1% to the BER. The 
dual-fire rate — the probability that both SPDs fire dur- 
ing a coincidence window — was 0.0003, 0.0007, and 0.001 
at n ~ 0.2, 0.35, and 0.5, respectively. 

Alice and Bob can correct errors by transmitting error 
correction information over the public channel, amount- 
ing to 

/(e) = -elog 2 e-(l-e)log 2 (l-e) (1) 

bits per bit of sifted key in the Shannon limit. For ex- 
ample, for e = 4.1%, /(0.041) = 0.246. Practical error- 
correcting codes do not achieve the Shannon limit, al- 
though the interactive scheme known as Cascade [f22| , 
comes within about 1.16 /(e) for error rates up to 5% 
|jl3f . Our experiments use a combination of block-parity 
checks and Hamming codes achieving an efficiency 
equivalent to the Cascade scheme but with greater com- 
putational efficiency. The error correction information is 
transmitted over the public channel and thus could pro- 
vide information about the key material to Eve, reducing 
Alice and Bob's secret bit yield. (Alice and Bob could 
encrypt the error correction information to deny Eve ac- 
cess to it, but at the cost of an equal number of shared 
secret key bits [pi[.) 

Alice and Bob now use "privacy amplification" ]l7j to 
reduce any partial knowledge gained by an eavesdrop- 
per to less than 1-bit of information. (For discussions of 
eavesdropping strategies see References [|l3|,^5[^6).) We 
have not implemented privacy amplification at this time, 
but to estimate the secret-key rate for our experiment 
and its dependencies on relative parameters, we assume 
Eve is restricted to performing the combination of the 
intercept-resend and beamsplitting attacks considered in 
In this case Alice and Bob could use the parities 
of random subsequences of their error-corrected keys as 
their final secret key bits, resulting in a compression to 

F(e) = (1 - n) - 2\/2e (2) 

bits per bit of error-corrected key. The first term in Eq. 
U accounts for the multi-photon fraction of Alice's dim- 
pulses, which are susceptible to beamsplitting, while the 
second accounts for Eve performing intercept-resend on 
a fraction of the pulses. The final secret bit yield is 
therefore a fraction F(e) — /(e) the length of the orig- 
inal sifted key. For n < 0.05, under the conditions of 
our 13 August 1999 experiment with rj svstem = 0.13, 
there is no net secret bit yield because of the large value 
/(e). With increasing n the BER decreases so rapidly 
that the increased privacy amplification cost to protect 
against beamsplitting is more than offset by the reduced 
error-correction cost, and so the secret bit yield initially 
increases. However, for larger n values, the privacy am- 
plification factor F(e) required to compensate for beam- 
splitting of multi-photon pulses becomes small, and the 



secret bit yield decreases. For r\ S ystem — 0.13, we find 
that the optimum n for our 13 August 1999 experiment 
is ~ 0.4 giving a secret bit yield of 38.5% of the sifted 
key length, and ~ 0.4% of the length of the transmitted 
sequence. (With Cascade the optimal n would also be 
~ 0.4 and the secret bit yield would be 24.7% of the sifted 
key or 0.32% the length of the transmitted sequence, giv- 
ing a secret bit rate of ~ 3-kHz.) For smaller rj S y Stem 
values under 13 August 1999 conditions the optimal n 
values are as above but the secret bit yield is smaller; 
for rjsystem, < 0.04 there is no secret bit yield. (To pro- 
tect against the attacks proposed in jl3| , should they be- 
come feasible, we would need to reduce our background 
further with a shorter coincidence gate window and nar- 
rower spectral filters to have a non-zero secret-bit yield 
at the n values required.) 

This paper reports QKD between a transmitter and 
receiver separated by a 1.6-km daylight atmospheric op- 
tical path. This transmission distance, which was only 
limited by the length of the available range, is the longest 
to date. Our system has no active polarization elements, 
resulting in greater simplicity and security over previous 
experiments. Secret bit rates of several kilo-Hertz pro- 
tected against simple beamsplitting and intersept-resend 
attacks have been shown to be feasible. Such rates would 
enable the rekeying of cryptographic systems. The sys- 
tem could be easily adapted to the BB84 four-state QKD 
protocol Q or to use single-photon light sources |27|] once 
they are available, providing protection against more so- 
phisticated future attacks p3| , p5| , p6| . Our results are 
representative of practical situations showing that QKD 
could be used in conjunction with optical communication 
systems and providing further evidence for the feasibility 
of surface-to-satellite QKD ||. The 1.6-km optical path 
is similar in optical depth to the effective turbulent at- 
mospheric thickness encountered in a surface-to-satellite 
application. Significant amounts of key-material (about 
15 k-bits) with low BERs ((e) < 3.0%) at low n (ra < 0.2) 
were also taken at night and during light rain over this 
1.6-km distance. Finally, we note that the variability 
of system efficiency and background is a feature of at- 
mospheric QKD that is quite different from optical fiber 
systems. 
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FIG. 1. Free-Space QKD Transmitter (Alice) 
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FIG. 2. Free-Space QKD Receiver (Bob). 

TABLE I. A 250-bit sample of Alice's (a) and Bob's (b) 
raw key material generated at Los Alamos, New Mexico at 
10:00 LST (GMT - 7) on Friday 13 August 1999. Alice was 
located at 1978-m elevation, 35° 46.859' N, and 106° 14.932' 
W; Bob was located at 1966-m elevation, 35° 46.376' N, and 
106° 14.052' W. The beam height at Alice's transmitter and 
Bob' receiver was 1.5-m; the maximum beam height of 107-m 
above the terrain occurred 1 km from Alice; and the average 
beam height above the terrain was ~ 38-m. 



00011011110111010111010000101011111101111101110000 
10011011110011010110011000101011111101111101110000 



01111110111100011011000010111101110010000101001010 
01111110101100011011000000111101110010000101001010 



00011110111110000100011 
00011110110110000100011 



111001111011011011101101111 
111001111011011011101101111 



10010010100100100100111 
10010010100100100100111 



100000001101001111100101111 
100000001101001111100101O11 



11111111111111111000011 
11111111111111111000011 



111011101101110101100011101 
111011101101110101100011101 



